Mailman 3 March 2004 - Mailman-coders

[ mailman-Bugs-688751 ] Scrubber/attachment bug on NetBSD
by SourceForge.net 12 Mar '04

12 Mar '04

Bugs item #688751, was opened at 2003-02-18 11:55 Message generated for change (Comment added) made by awrede You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=688751&group_i… Category: mail delivery Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Eric Ding (ericding) Assigned to: Nobody/Anonymous (nobody) Summary: Scrubber/attachment bug on NetBSD Initial Comment: I'm using Mailman 2.1.1, and have encountered issues with mail delivery of messages with attachments (having to do, I think, with the recent change to use the scrubber on such messages for digests). I actually have ARCHIVE_SCRUBBER set to 0 on my system, since I use MHonArc for archiving. Still, the scrubber is called from ToDigest. As a result of this bug, ANY message with an attachment is currently getting shunted!! :( Here's an example stacktrace from the error log: Feb 18 11:20:55 2003 (7122) Uncaught runner exception: [Errno 1] Operation not permitted: '/home/mailman/archives/private/greengrass_coordinator/attachments/20030217/d2897c2f' Feb 18 11:20:55 2003 (7122) Traceback (most recent call last): File "/home/mailman/Mailman/Queue/Runner.py", line 105, in _oneloop self._onefile(msg, msgdata) File "/home/mailman/Mailman/Queue/Runner.py", line 155, in _onefile keepqueued = self._dispose(mlist, msg, msgdata) File "/home/mailman/Mailman/Queue/IncomingRunner.py", line 130, in _dispose more = self._dopipeline(mlist, msg, msgdata, pipeline) File "/home/mailman/Mailman/Queue/IncomingRunner.py", line 153, in _dopipeline sys.modules[modname].process(mlist, msg, msgdata) File "/home/mailman/Mailman/Handlers/ToDigest.py", line 82, in process send_digests(mlist, mboxfp) File "/home/mailman/Mailman/Handlers/ToDigest.py", line 123, in send_digests send_i18n_digests(mlist, mboxfp) File "/home/mailman/Mailman/Handlers/ToDigest.py", line 295, in send_i18n_digests msg = scrubber(mlist, msg) File "/home/mailman/Mailman/Handlers/Scrubber.py", line 219, in process url = save_attachment(mlist, part, dir, filter_html=0) File "/home/mailman/Mailman/Handlers/Scrubber.py", line 341, in save_attachment makedirs(fsdir) File "/home/mailman/Mailman/Handlers/Scrubber.py", line 333, in makedirs os.path.walk(dir, twiddle, None) File "/usr/pkg/lib/python2.2/posixpath.py", line 279, in walk func(arg, top, names) File "/home/mailman/Mailman/Handlers/Scrubber.py", line 332, in twiddle os.chmod(dirname, 02775) OSError: [Errno 1] Operation not permitted: '/home/mailman/archives/private/greengrass_coordinator/attachments/20030217/d2897c2f' To work aorund this issue, I've currently commented out lines 331-333 on my system. ---------------------------------------------------------------------- Comment By: Andreas Wrede (awrede) Date: 2004-03-11 19:19 Message: Logged In: YES user_id=11718 I can confirm the original problem. Unlike dkhelmet's problem on OpenBSD with incorrect permissions, my check_perm reports No Problem. The work-around of commenting out the function twiddle() and the os.path.walk on lines 342ff works. Enviroment is NetBSD 1.6.1, with python 2.1.3 and mailman 2.1.4, both installed from NetBSD's pkgsrc system (ie. mailman gets installed with DIRSETGID) ---------------------------------------------------------------------- Comment By: Jeff Labonski (dkhelmet) Date: 2003-10-16 00:23 Message: Logged In: YES user_id=8939 I can confirm this on OpenBSD 3.3 running Mailman 2.1.3 and Postfix 2.0.16. I get the same exact error. Perhaps I should try reinstalling without following the setgid flag for BSD. Just for confirmation, after each email is sent with an attachment, check_perms reports it doesn't have 02775 permissions. After check_perms -f is run and another email sent, the same thing occurs, but for a different directory. Commenting out the offending lines seems to have fixed the problem; even the archive is correct. I'll try recompiling in a day or two after I get some sleep. ---------------------------------------------------------------------- Comment By: Eric Ding (ericding) Date: 2003-04-08 12:07 Message: Logged In: YES user_id=302756 The only problems that check_perms reveals are all the directories that do not have the setgid bit set. I installed with README.BSD in mind, assuming that the setgid bit is unnecessary. Running check_perms -f to turn on that bit has no effect on the behavior. ---------------------------------------------------------------------- Comment By: Barry A. Warsaw (bwarsaw) Date: 2003-04-07 18:37 Message: Logged In: YES user_id=12800 I need more information for this one. Do you still get the crash if you run check_perms first? I've never seen this on Linux and I don't have a NetBSD box available to see if there's some platform specific problem involved. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=688751&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 12 Mar '04

12 Mar '04

Bugs item #914249, was opened at 2004-03-11 11:28 Message generated for change (Comment added) made by nes49 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- Comment By: NancyS (nes49) Date: 2004-03-11 15:01 Message: Logged In: YES user_id=995718 As one of the other people reporting the problem, let me add a bit of info on our experience. Mailman 2.1.1 My hypothesis now is that one of the people who could post without moderation released the virus. [I haven't been able to get definitive confirmation of that, but coupling "we were having some trouble" with a match on the ISP domain name leads me to that guess.] I haven't been able to tie the messages to a specific address subscribed to the list, but would be glad to probe further if given some direction. We haven't seen any additional occurrences since turning on moderation for all users. Between the first and second attack, I changed the passwords for the affected lists thinking that an Approved: header might have been used, but there's no evidence that was the case. -Nancy mailman <at> sgtst.com ---------------------------------------------------------------------- Comment By: Caleb Epstein (cepstein) Date: 2004-03-11 14:36 Message: Logged In: YES user_id=36183 The virus is making it through to the lists by using an "envelope-from" (I believe that is the right term) of a valid, subscribed list member, but a From: header which is some address that does not exist and is not a member of the list (usually admin@ or management@ the mailing list's domain). See for example the message at http://bklyn. org/~cae/mailman-stumper.txt This message appears first in the MTA's logs as: 2004-03-11 16:31:44 1B1T5z-0009zY-00 <= SUBSCRIBER(a)DOMAIN.COM H=(srr2) [192.168.100.17] P=smtp S=17730 id=pbecvykwgcgqjemyxjx(a)Etree.org from <SUBSCRIBER(a)DOMAIN.COM> for Announce(a)etree.org where SUBSCRIBER(a)DOMAIN.COM is a valid list subscriber with posting privileges. ---------------------------------------------------------------------- Comment By: NancyS (nes49) Date: 2004-03-11 14:15 Message: Logged In: YES user_id=995718 As one of the other people reporting the problem, let me add a bit of info on our experience. Mailman 2.1.1 My hypothesis now is that one of the people who could post without moderation released the virus. [I haven't been able to get definitive confirmation of that, but coupling "we were having some trouble" with a match on the ISP domain name leads me to that guess.] I haven't been able to tie the messages to a specific address subscribed to the list, but would be glad to probe further if given some direction. We haven't seen any additional occurrences since turning on moderation for all users. Between the first and second attack, I changed the passwords for the affected lists thinking that an Approved: header might have been used, but there's no evidence that was the case. -Nancy mailman <at> sgtst.com ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 12:28 Message: Logged In: YES user_id=995621 ... sorry, hit the submit button too soon... THe nom-member messages that get past the non-member filter are being caught by the forced moderation so the messages are not getting to the list itself. It does make us nervous though. ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 12:20 Message: Logged In: YES user_id=995621 More generally we have only moderated, read-only lists for our users. All incoming, non-member messages should be discarded. We are seeing a few virus laden messages from obvious non-members getting past the non-member filters. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 12 Mar '04

12 Mar '04

Bugs item #914249, was opened at 2004-03-11 16:28 Message generated for change (Comment added) made by cepstein You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- Comment By: Caleb Epstein (cepstein) Date: 2004-03-11 19:36 Message: Logged In: YES user_id=36183 The virus is making it through to the lists by using an "envelope-from" (I believe that is the right term) of a valid, subscribed list member, but a From: header which is some address that does not exist and is not a member of the list (usually admin@ or management@ the mailing list's domain). See for example the message at http://bklyn. org/~cae/mailman-stumper.txt This message appears first in the MTA's logs as: 2004-03-11 16:31:44 1B1T5z-0009zY-00 <= SUBSCRIBER(a)DOMAIN.COM H=(srr2) [192.168.100.17] P=smtp S=17730 id=pbecvykwgcgqjemyxjx(a)Etree.org from <SUBSCRIBER(a)DOMAIN.COM> for Announce(a)etree.org where SUBSCRIBER(a)DOMAIN.COM is a valid list subscriber with posting privileges. ---------------------------------------------------------------------- Comment By: NancyS (nes49) Date: 2004-03-11 19:15 Message: Logged In: YES user_id=995718 As one of the other people reporting the problem, let me add a bit of info on our experience. Mailman 2.1.1 My hypothesis now is that one of the people who could post without moderation released the virus. [I haven't been able to get definitive confirmation of that, but coupling "we were having some trouble" with a match on the ISP domain name leads me to that guess.] I haven't been able to tie the messages to a specific address subscribed to the list, but would be glad to probe further if given some direction. We haven't seen any additional occurrences since turning on moderation for all users. Between the first and second attack, I changed the passwords for the affected lists thinking that an Approved: header might have been used, but there's no evidence that was the case. -Nancy mailman <at> sgtst.com ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 17:28 Message: Logged In: YES user_id=995621 ... sorry, hit the submit button too soon... THe nom-member messages that get past the non-member filter are being caught by the forced moderation so the messages are not getting to the list itself. It does make us nervous though. ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 17:20 Message: Logged In: YES user_id=995621 More generally we have only moderated, read-only lists for our users. All incoming, non-member messages should be discarded. We are seeing a few virus laden messages from obvious non-members getting past the non-member filters. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 12 Mar '04

12 Mar '04

Bugs item #914249, was opened at 2004-03-11 11:28 Message generated for change (Comment added) made by nes49 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- Comment By: NancyS (nes49) Date: 2004-03-11 14:15 Message: Logged In: YES user_id=995718 As one of the other people reporting the problem, let me add a bit of info on our experience. Mailman 2.1.1 My hypothesis now is that one of the people who could post without moderation released the virus. [I haven't been able to get definitive confirmation of that, but coupling "we were having some trouble" with a match on the ISP domain name leads me to that guess.] I haven't been able to tie the messages to a specific address subscribed to the list, but would be glad to probe further if given some direction. We haven't seen any additional occurrences since turning on moderation for all users. Between the first and second attack, I changed the passwords for the affected lists thinking that an Approved: header might have been used, but there's no evidence that was the case. -Nancy mailman <at> sgtst.com ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 12:28 Message: Logged In: YES user_id=995621 ... sorry, hit the submit button too soon... THe nom-member messages that get past the non-member filter are being caught by the forced moderation so the messages are not getting to the list itself. It does make us nervous though. ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 12:20 Message: Logged In: YES user_id=995621 More generally we have only moderated, read-only lists for our users. All incoming, non-member messages should be discarded. We are seeing a few virus laden messages from obvious non-members getting past the non-member filters. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 11 Mar '04

11 Mar '04

Bugs item #914249, was opened at 2004-03-11 10:28 Message generated for change (Comment added) made by karres You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 11:28 Message: Logged In: YES user_id=995621 ... sorry, hit the submit button too soon... THe nom-member messages that get past the non-member filter are being caught by the forced moderation so the messages are not getting to the list itself. It does make us nervous though. ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 11:20 Message: Logged In: YES user_id=995621 More generally we have only moderated, read-only lists for our users. All incoming, non-member messages should be discarded. We are seeing a few virus laden messages from obvious non-members getting past the non-member filters. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 11 Mar '04

11 Mar '04

Bugs item #914249, was opened at 2004-03-11 10:28 Message generated for change (Comment added) made by karres You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- Comment By: dk (karres) Date: 2004-03-11 11:20 Message: Logged In: YES user_id=995621 More generally we have only moderated, read-only lists for our users. All incoming, non-member messages should be discarded. We are seeing a few virus laden messages from obvious non-members getting past the non-member filters. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-914249 ] Virus posts to moderated lists
by SourceForge.net 11 Mar '04

11 Mar '04

Bugs item #914249, was opened at 2004-03-11 10:28 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i… Category: security/privacy Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: Ted Peterson (knighted) Assigned to: Nobody/Anonymous (nobody) Summary: Virus posts to moderated lists Initial Comment: The W32.Beagle virus has been able to post multiple times to a moderated Mailman 2.1.3 mailing list, so emergency moderation of the list has been enabled. At least two other people, as reported on mailman-users, have had this trouble since last Friday, March 5th, when W32.Beagle was spreading. The virus was posting using a moderator address, so that moderator was removed. The moderator bit is and was turned on for all users, including the now *sole* moderator. I can send the mbox archive headers to anybody who is interested. Mail: ted <at> ire.org --Ted ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=914249&group_i…

1 0

[ mailman-Bugs-913397 ] Subscriber E-Mail-Address: GlobalChange causes removal
by SourceForge.net 10 Mar '04

10 Mar '04

Bugs item #913397, was opened at 2004-03-10 11:53 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=913397&group_i… Category: None Group: 2.1 (stable) Status: Open Resolution: None Priority: 5 Submitted By: chris-taylor (chris-taylor) Assigned to: Nobody/Anonymous (nobody) Summary: Subscriber E-Mail-Address: GlobalChange causes removal Initial Comment: A subscriber of some mailinglists on my site tried to change his email address globally. The change for one of the lists only affected a correction of upper- and lower-case letters in the local part of the address(e.g. will.smith@... -> Will.Smith@....). After confirming the change an error occured and the subscriber was completely unsubscribed from the list. Neither the old address nor the new address were registered in the subscribers list. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=100103&aid=913397&group_i…

1 0

[ mailman-Patches-912448 ] Config setting to force relative URLs
by SourceForge.net 10 Mar '04

10 Mar '04

Patches item #912448, was opened at 2004-03-08 18:57 Message generated for change (Comment added) made by multitalents You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=912448&group_i… Category: None Group: Mailman 2.1 Status: Open Resolution: None Priority: 5 Submitted By: Steve Kostecke (kostecke) Assigned to: Nobody/Anonymous (nobody) Summary: Config setting to force relative URLs Initial Comment: Mailman 2.1.1 uses absolute URLs for all references to mailing lists. This behavior may be useful when one Mailman installation runs lists on multiple virtual hosts. However, this behavior reduces the flexibility of Mailman by making it impossible to use Mailman in configurations where you need to be able to use different hostnames to refer to the same lists (e.g. where HTTP and HTTPS use different virtual hosts). This patch modifies the ScriptURL function in ./Mailman/Utils.py to allow relative URLs to be forced by setting a mm_cfg configuration variable: RELATIVE_URLS. This patch also modifies Defaults.py to provide the default value for RELATIVE_URLS. <pre> --- Utils.py.orig Tue Mar 9 02:45:20 2004 +++ Utils.py Tue Mar 9 02:10:51 2004 @@ -238,7 +238,7 @@ fullpath = os.environ.get('SCRIPT_NAME', '') + os.environ.get('PATH_INFO', '') baseurl = urlparse.urlparse(web_page_url)[2] - if not absolute and fullpath.endswith(baseurl): + if mm_cfg.RELATIVE_URLS or not absolute and fullpath.endswith(baseurl): # Use relative addressing fullpath = fullpath[len(baseurl):] i = fullpath.find('?') --- Defaults.py.orig Tue Mar 9 02:44:44 2004 +++ Defaults.py Tue Mar 9 02:15:13 2004 @@ -782,6 +782,9 @@ # list's config variable default_member_moderation. DEFAULT_NEW_MEMBER_OPTIONS = 256 +# Set this to 1 to enable relative URLs. +RELATIVE_URLS = 0 ##### # List defaults. NOTE: Changing these values does NOT change the </pre> ---------------------------------------------------------------------- Comment By: Multitalents (multitalents) Date: 2004-03-09 21:38 Message: Logged In: YES user_id=994460 Your patch seems to be fine for the web interface but it breaks the URLs in e-mail notifications. Relative URLs are worthless in e-mails. Any ideas on how to fix this? ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=300103&aid=912448&group_i…

1 0

[ mailman-Feature Requests-913035 ] Headertrimmer builtin to Mailman
by SourceForge.net 10 Mar '04

10 Mar '04

Feature Requests item #913035, was opened at 2004-03-09 22:09 Message generated for change (Tracker Item Submitted) made by Item Submitter You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=350103&aid=913035&group_i… Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: David B (duelago) Assigned to: Nobody/Anonymous (nobody) Summary: Headertrimmer builtin to Mailman Initial Comment: A script to filter mail and manipulate arbitrary unstructured mailheaders. Get rid of multiple subjectmutations (like these: "Re: RE: [mylist] SV: Aw: Re:[mylist] Re:[mylist]") in to a nice header. Look at this version in perl http://x42.com/software/mail/ Fully honours RFC2047 for unstructured headers and is therefore perfect for 8-bit-charset-people in the old, eastern and other non- english part of the world. Re-encodes headers to ensure that they follow RFC2047 as a lot of clients break the standard which is the cause of MIME-headermutations. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=350103&aid=913035&group_i…

1 0